On October 30, 2023, the SEC filed a litigated complaint against SolarWinds, a software development company, and Timothy Brown, its chief information security officer (CISO). The SEC alleges that from October 2018, when SolarWinds went public, to January 2021, SolarWinds …

On March 2, 2023, the White House Office of the National Cyber Director (“ONCD”) released the Biden Administration’s (the “Administration”) long-awaited National Cybersecurity Strategy (the “Strategy”), the first since the Trump Administration’s strategy was issued in September 2018. The Strategy …

The SEC proposed an array of new cybersecurity-related requirements in the form of: (1) an expansive new Rule 10, (2) extending the reach of Regulation SCI, and (3) expanding Regulation S-P, including to require incident response programs. The SEC also …

On March 9, 2023, the Securities and Exchange Commission (the “SEC”) Enforcement Division’s Crypto Assets and Cyber Unit announced a settlement with Blackbaud, Inc. involving allegations of inadequate disclosure controls and procedures and material misstatements and omissions concerning a 2020 …

In 2022, public companies witnessed a new kind of corporate governance activism. New rules and regulations from the Securities and Exchange Commission (the SEC) use the lever of mandated disclosure to push for corporate governance actions, and in some cases …

While the world recovers from the worst of the pandemic, the economic, political and social repercussions will continue to play out in ways that, while unpredictable, are in some respects characterized by observable patterns of cause-and-effect and cyclicality.  The pendulum …

One of the most difficult challenges for cybersecurity professionals is the increasing complexity of corporate systems. Mergers, vendor integrations, new software tools and remote work all expand the footprint of companies’ information systems, creating a larger attack surface for hackers. …

On September 15, 2022, President Joe Biden issued an executive order (EO) “on ensuring robust consideration of evolving national security risks” by the Committee on Foreign Investment in the United States (CFIUS or the Committee). The EO does not change …

While recent gyrations in cryptoasset markets have focused attention on the future contours of stablecoins, market-making, and impending regulation, another feature of the blockchain landscape is also confronting noteworthy challenges.  Specifically, a new breed of business organization has emerged …

On February 9, 2022, the Securities and Exchange Commission (the “SEC”) voted 3 to 1 (Commissioner Peirce dissenting[1]) to propose cybersecurity risk management rules and amendments for registered investment advisers, registered investment companies and business development companies (the …

On March 15, 2022, President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the “Act”) into law, requiring critical infrastructure entities to report covered cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 …